1.AhmadHassan-BTed / OpenHeart
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
+5,860 stars
from 168 · score 8.68
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
1–100 of 101 by Attention Score · Oct 4, 2026 – Nov 2, 2026 (UTC)
2.openqodex / openqodex
Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Codex, Cursor and Cline. No account or key of its own.
+1,126 stars
from 2 · score 7.03
3.repowise-dev / repowise
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
+988 stars
from 7,102 · score 6.90
4.WerWolv / ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
+775 stars
from 54,916 · score 6.65
5.tirth8205 / code-review-graph
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
+719 stars
from 31,824 · score 6.58
6.astral-sh / ruff
An extremely fast Python linter and code formatter, written in Rust.
+593 stars
from 49,796 · score 6.39
7.semgrep / semgrep
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
+566 stars
from 16,834 · score 6.34
8.ast-grep / ast-grep
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
+323 stars
from 16,086 · score 5.78
9.fallow-rs / fallow
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
+318 stars
from 4,971 · score 5.77
10.MobSF / Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
+251 stars
from 21,845 · score 5.53
11.horsicq / Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
+238 stars
from 11,605 · score 5.48
12.anchore / grype
A vulnerability scanner for container images and filesystems
+194 stars
from 12,961 · score 5.27
13.anchore / syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
+186 stars
from 9,624 · score 5.23
14.koalaman / shellcheck
ShellCheck, a static analysis tool for shell scripts
+170 stars
from 40,099 · score 5.14
15.kucherenko / jscpd
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
+164 stars
from 6,318 · score 5.11
16.rshipp / awesome-malware-analysis
Defund the Police.
+136 stars
from 14,229 · score 4.92
17.SonarSource / sonarqube
Continuous Inspection
+103 stars
from 11,033 · score 4.64
18.OWASP / mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
+96 stars
from 13,211 · score 4.57
19.bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
+79 stars
from 9,047 · score 4.38
20.carthage-software / mago
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
+70 stars
from 3,471 · score 4.26
21.hadolint / hadolint
Dockerfile linter, validate inline bash, written in Haskell
+59 stars
from 12,445 · score 4.09
22.Col-E / Recaf
The modern Java bytecode editor
+55 stars
from 7,397 · score 4.03
23.dwisiswant0 / apkleaks
Scanning APK file for URIs, endpoints & secrets.
+55 stars
from 6,319 · score 4.03
24.Konloch / bytecode-viewer
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
+49 stars
from 15,652 · score 3.91
25.analysis-tools-dev / static-analysis
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
+49 stars
from 14,812 · score 3.91
26.checkstyle / checkstyle
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
+45 stars
from 9,582 · score 3.83
27.realm / SwiftLint
A tool to enforce Swift style and conventions.
+42 stars
from 19,736 · score 3.76
28.securego / gosec
Go security checker
+40 stars
from 8,955 · score 3.71
29.tanprathan / MobileApp-Pentest-Cheatsheet
The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.
+36 stars
from 5,283 · score 3.61
30.phpstan / phpstan
PHP Static Analysis Tool - discover bugs in your code without running it!
+35 stars
from 14,111 · score 3.58
31.meta / infer
A static analyzer for Java, C, C++, and Objective-C
+32 stars
from 15,708 · score 3.50
32.detekt / detekt
Static code analysis for Kotlin
+29 stars
from 7,077 · score 3.40
33.pmd / pmd
An extensible multilanguage static code analyzer.
+29 stars
from 5,494 · score 3.40
34.google / error-prone
Catch common Java mistakes as compile-time errors
+27 stars
from 7,239 · score 3.33
35.cppcheck-opensource / cppcheck
static analysis of C/C++ code
+27 stars
from 6,763 · score 3.33
36.dominikh / go-tools
Staticcheck - The advanced Go linter
+26 stars
from 6,895 · score 3.30
37.Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
+24 stars
from 2,755 · score 3.22
38.pylint-dev / pylint
It's not just a linter that annoys you!
+23 stars
from 5,725 · score 3.18
39.zubanls / zuban
Python Type Checker / Language Server
+23 stars
from 1,207 · score 3.18
40.quay / clair
Vulnerability Static Analysis for Containers
+22 stars
from 11,064 · score 3.14
41.PHP-CS-Fixer / PHP-CS-Fixer
A tool to automatically fix PHP Coding Standards issues
+19 stars
from 13,550 · score 3.00
42.presidentbeef / brakeman
A static analysis security vulnerability scanner for Ruby on Rails applications
+19 stars
from 7,273 · score 3.00
43.aquasecurity / tfsec
Tfsec is now part of Trivy
+19 stars
from 7,039 · score 3.00
44.spotbugs / spotbugs
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
+18 stars
from 3,947 · score 2.94
45.uber / NullAway
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
+16 stars
from 4,111 · score 2.83
46.ttroy50 / cmake-examples
Useful CMake Examples
+15 stars
from 13,052 · score 2.77
47.safedep / vet
Protect against malicious open source packages 🤖
+15 stars
from 1,108 · score 2.77
48.shipmonk-rnd / dead-code-detector
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
+13 stars
from 521 · score 2.64
49.revive-lint / revive
🔥 Fast, strict, configurable, extensible, and beautiful linter for Go
+12 stars
from 5,548 · score 2.56
50.PyCQA / flake8
flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.
+11 stars
from 3,822 · score 2.48
51.carlosas / phpat
✔️ PHP Architecture Tester - Easy architecture testing for PHP
+11 stars
from 1,279 · score 2.48
52.meta / pyre-checkArchived
Performant type-checking for python.
+10 stars
from 7,171 · score 2.40
53.davidhalter / jedi
Awesome autocompletion, static analysis and refactoring library for python
+10 stars
from 6,173 · score 2.40
54.phpmd / phpmd
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
+10 stars
from 2,454 · score 2.40
55.mbj / mutant
Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?
+10 stars
from 2,203 · score 2.40
56.PHPCSStandards / PHP_CodeSniffer
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
+10 stars
from 1,557 · score 2.40
57.NASA-SW-VnV / ikos
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
+9 stars
from 3,168 · score 2.30
58.Shopify / rubydex
A high-performance static analysis toolkit for Ruby
+9 stars
from 363 · score 2.30
59.nikic / PHP-Parser
A PHP parser written in PHP
+8 stars
from 17,456 · score 2.20
60.shivammathur / setup-php
GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.
+8 stars
from 3,261 · score 2.20
61.INRIA / spoon
Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.
+8 stars
from 1,955 · score 2.20
62.rrrene / credo
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
+7 stars
from 5,222 · score 2.08
63.find-sec-bugs / find-sec-bugs
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
+7 stars
from 2,446 · score 2.08
64.vimeo / psalm
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
+6 stars
from 5,891 · score 1.95
65.troessner / reek
Code smell detector for Ruby
+6 stars
from 4,131 · score 1.95
66.whitesmith / rubycritic
A Ruby code quality reporter
+6 stars
from 3,502 · score 1.95
67.BinaryAnalysisPlatform / bap
Binary Analysis Platform
+6 stars
from 2,258 · score 1.95
68.clj-kondo / clj-kondo
Static analyzer and linter for Clojure code that sparks joy
+6 stars
from 1,859 · score 1.95
69.gmh5225 / awesome-llvm-security
awesome llvm security [Welcome to PR]
+6 stars
from 884 · score 1.95
70.didi / booster
🚀Optimizer for mobile applications
+5 stars
from 5,072 · score 1.79
71.ondrajz / go-callvis
Visualize call graph of a Go program using Graphviz
+4 stars
from 6,524 · score 1.61
72.phan / phan
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
+4 stars
from 5,620 · score 1.61
73.Ericsson / codechecker
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
+4 stars
from 2,627 · score 1.61
74.nccgroup / sobelow
Security-focused static analysis for the Phoenix Framework
+4 stars
from 1,794 · score 1.61
75.phpstan / phpdoc-parser
Next-gen phpDoc parser with support for intersection types and generics
+4 stars
from 1,537 · score 1.61
76.SonarSource / sonar-dotnet
Code analyzer for C# and VB.NET projects
+4 stars
from 918 · score 1.61
77.crystal-ameba / ameba
A static code analysis tool for Crystal
+4 stars
from 567 · score 1.61
78.shobrook / adrenaline
Chat with (and visualize) your codebase
+3 stars
from 3,732 · score 1.39
79.PicnicSupermarket / error-prone-support
Error Prone extensions: extra bug checkers and a large battery of Refaster rules.
+3 stars
from 41 · score 1.39
80.squizlabs / PHP_CodeSniffer
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
+2 stars
from 10,763 · score 1.10
81.qax-os / goreporter
A Golang tool that does static analysis, unit testing, code review and generate code quality report.
+2 stars
from 3,121 · score 1.10
82.glebm / i18n-tasks
Manage translation and localization with static analysis, for Ruby i18n
+2 stars
from 2,158 · score 1.10
83.Ericsson / CodeCompass
CodeCompass is a software comprehension tool for large scale software written in C/C++, C# and Python.
+2 stars
from 612 · score 1.10
84.hirrolot / mazeppa
A modern supercompiler for call-by-value functional languages
+2 stars
from 477 · score 1.10
85.gaul / modernizer-maven-plugin
Detect uses of legacy Java APIs
+2 stars
from 393 · score 1.10
86.DosX-dev / Astral-PE
Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)
+2 stars
from 354 · score 1.10
87.antonagestam / phantom-types
Phantom types for Python.
+2 stars
from 233 · score 1.10
88.ECSIM / opem
OPEM (Open Source PEM Fuel Cell Simulation Tool)
+2 stars
from 232 · score 1.10
89.cpeoples / ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
+2 stars
from 10 · score 1.10
90.google / pytypeArchived
A static type analyzer for Python code
+1 stars
from 5,033 · score 0.69
91.rubocop / rubocop-rspec
Code style checking for RSpec files.
+1 stars
from 859 · score 0.69
92.secrary / Andromeda
Andromeda - Interactive Reverse Engineering Tool for Android Applications
+1 stars
from 713 · score 0.69
93.insidersec / insider
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
+1 stars
from 553 · score 0.69
94.refactorfirst / RefactorFirst
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
+1 stars
from 547 · score 0.69
95.ayarotsky / diesel-guard
Linter for dangerous Postgres migration patterns in Diesel and SQLx. Prevents downtime caused by unsafe schema changes.
+1 stars
from 120 · score 0.69
96.orsinium-labs / infer-types
A CLI tool to automatically add type annotations into Python code. Must have tool for annotating existing code.
+1 stars
from 102 · score 0.69
97.nenadvulic / solid-like-a-rock
Architecture linter for Swift — enforce Clean Architecture import rules via SwiftSyntax. A CI-ready guardrail for AI-assisted development.
+1 stars
from 30 · score 0.69
98.mennanov / blockwatch
Cross-file drift checker. Keeps code, configs, and docs in sync deterministically. Supports 35+ languages.
+1 stars
from 29 · score 0.69
99.shinagawa-web / gomarklint
Catch broken links before your readers do.
+1 stars
from 19 · score 0.69
100.mickelsamuel / migrationpilot
PostgreSQL migration linter. Blocks unsafe migrations before merge: 112 rules, the real Postgres parser, lock analysis, auto-fix. CLI, GitHub Action, MCP.
+1 stars
from 8 · score 0.69